Install and run the audit daemon

Description

The Linux audit framework records events chosen by rules (system calls, file accesses, program runs) with the identity of the user who logged in. auditd (package auditd) receives these records from the kernel and writes them to /var/log/audit/audit.log; audispd-plugins adds the plugins that forward them (syslog, remote server). Neither is installed by default.

This control requires both packages and the auditd service enabled and running.

Rationale

The audit log is the detailed, per-user record that investigations rely on after an intrusion. It is also required by the audit rules controls CB-DEB-AUDIT-016 to CB-DEB-AUDIT-029.

Impact

auditd uses a few megabytes of memory. The disk space used depends on the rules and on the activity; see CB-DEB-AUDIT-013 and CB-DEB-AUDIT-014.

Setting

Audit

1. Run dpkg-query -W -f='${Package} ${Status}\n' auditd audispd-plugins. Both must end with installed.
2. Run systemctl is-enabled auditd and systemctl is-active auditd. They must print enabled and active.

Automated: every check must pass. Scanners report each check by its id.

auditd

auditd is installed.

name: auditd
state: installed

plugins

audispd-plugins is installed.

name: audispd-plugins
state: installed

service

auditd.service is enabled.

unit: auditd.service
state: enabled

Remediation

Run apt-get install auditd audispd-plugins, then systemctl enable --now auditd.

Rollback

Run apt-get purge auditd audispd-plugins.

auditd

Generated from check auditd: the engine writes the fix for every output, it sets the expected value and the check runs again after.

plugins

Generated from check plugins: the engine writes the fix for every output, it sets the expected value and the check runs again after.

service

Generated from check service: the engine writes the fix for every output, it sets the expected value and the check runs again after.

Each release turns these fixes into remediate.sh and an Ansible role per profile: dry run by default, a fix runs only when its check fails.

References

• auditd.conf(5), Debian manual pages Debian, vendor-doc, accessed 2026-10-18
• ANSSI-BP-028 v2.0 - Recommandations de configuration d'un système GNU/Linux (R73) ANSSI, guide, accessed 2026-10-18

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

People and lifecycle